How to get offline access token using remix?

Shopify Apps

Topic summary

A developer is building a Shopify app using the @shopify/shopify-app-remix template and needs to obtain an offline access token for GraphQL Admin API calls to a separate backend.

Key Points:

  • The Remix template handles OAuth automatically and creates offline tokens by default during authentication
  • The access token is available in the session object returned by authenticate.admin(request)
  • Access it via session.accessToken in the loader function
  • This token can be sent to any third-party backend and stored in a database

Unresolved Issue:
A follow-up concern emerged where one user receives a shpua (user access token) instead of the expected shpat (admin access token), causing GraphQL permission errors. The discussion remains open regarding why this token type mismatch occurs and how to obtain the correct admin token for API queries.

Summarized with AI on October 31. AI used: claude-sonnet-4-5-20250929.
1

I am creating a new app using @Shopify_77 /shopify-app-remix as per documentation. I want to pass an offline accesToken to my backend and use it for GraphQL Admin API? Where in the documentation can I read how to do this??? In which specific object property it is located, in which place of remix application to make a request to my backend? Is it even possible to make a request to a third-party api? Please help

export async function loader({ request }) {
  const { admin, session } = await authenticate.admin(request);
}

export default function Index() {
  const { relax } = useLoaderData();

  return (
    <Page>
      <ui-title-bar title="QR codes">
        test-app-sinevik
      </ui-title-bar>
      <Layout>
        <Layout.Section>
          <Card padding="0">
            <p>{relax}</p>
          </Card>
        </Layout.Section>
      </Layout>
    </Page>
  );
}
2

If you are using the Shopify Remix App template then you don’t need to manually handle OAuth.

By default app will be creating and saving an offline token during OAuth. It is present in session token, You must have to check seesion object.
console log the session and you will find it

3

I can send it right there to my backend and save it to my database right? The backend address can be anything?

4

Maybe you know how to solve the problem with console output in remix templates?

5

snippet:

export const loader = async ({ request }) => {
const { admin, session } = await authenticate.admin(request);
console.log(session);
console.log(session.accessToken); // this is the one you want

6

Hey guys,

Following up on this discussion. If i do this

console.log(session); I obtain a accessToken: ‘shpua’

Which seems to not be a token access but user access … therefore, every GraphQL query I’m doing is resulting in permission error.

It seems I should have a shpat type of access token to do graphQL query. Any idea why I do get this?

Thanks a lot

1 Like